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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the 

application: 
Listing of Claims : 

1 . (Currently Amended) A method in a computer system for se curing 
automatically protecting data stored on a storage device from alteration , the computer system 
having an operating system, redirection drive r code, available storage, and redirected storage, 
comprising: 

starting the computer system from a first powered-down state, wherein the data 
stored in a plurality of original locations on the storage device is in an ori ginal state; 

loading the redirection driver code into a memory of the computer system; 
receiving a request te- for write access to a portion of data on the storage device, 
the request referring to an ~one of the original locations on the storage device; 
under control of the loaded redirection driver code , 

intercepting the request te- for write access to the data; 
determining whether the request refers to aa -a one of the original locations 
that has previously been redirected to redirected storage; 

when the request refers to an -the one of the original locations that has 
previously been redirected to redirected storage, using a location in redirected storage as a 
current redirected location, otherwise allocating available storage to a new location in redirected 
storage and using the new location as the current redirected location; and 

redirecting the write access request to refer to the current redirected 
location, such that the request transparently acc e ss e s writes to t he current redirected location 
instead of the original location; and 

restarting the computer system from a second powered-down state, wherein the 
data stored in the plurality of original locations on the storage device automatically remains 
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unaltered from the original state , without any restorative copying of dat a to the plurality of 
original locations . 

2. (Currently Amended) A computer system for securing automatically 
protecting data stored on a storage device from alteration , the data stored in a plurality of original 
locations on the storage device and in an original state when the computer system is started from 
a first powered-down state» comprising : 

data access request that requests modification refe^s-to an original location on the 

storage device; 

available storage; and 

redirection driver, installed in the computer system during power-up initialization, 

that, 

automatically intercepts the data access request; and 
redirects the access request to access a redirected location in the available 
storage, such that a requested modification at the original location is not performed and is instead 
performed to the redirected location, and such that, when the computer system is restored from a 
second p owered-down state, the data in the original location on the storage device automatically 
remains unaltered from the original state without any restorative copyin g of data to the plurality 
of original locations . 

3. (Currently Amended) A method in a computer system fo r using software 
loaded into memory during power-up initialization to automatically p rotecting data stored in a 
portion of a storage device having a designated protected space, the computer system having a 
redirected space, comprising: 

under control of the loaded software. 

intercepting a request from requesting code to aeeess -modify a location in 
the protected space of the storage device; and 

determining a location in the redirected space that is associated with the 
location in the protected space; and 
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redirecting the intercepted request to acc e ss modify t he determined 
location in the redirected space instead of the location in the protected space, in a manner that is 
transparent to the requesting code, so that the data stored in the location in the protected space 
automatically remains unaltered when the computer system is restarted from a powered-down 
state . 

4. (Original) The method of claim 3 wherein a redirection driver 
performs the intercepting the request, determining the location in the redirected space, and 
redirecting the intercepted request. 

5. (Original) The method of claim 4 wherein the driver is inserted into a 
driver hierarchy that is controlled by an operating system of the computer system. 

6. (Original) The method of claim 3 wherein the designated protected 
space of the storage device comprises the entire storage device. 

7. (Original) The method of claim 3 wherein the determined location in 
the redirected space resides in the storage device. 

8. (Original) The method of claim 3 wherein the determined location in 
the redirected space resides in an other storage device. 

9. (Currently Amended) The method of claim 3 , further comprising: 
intercepting from requesting code a request to read the location in the protected 

space of the storage device: 

determining the location in the redirected space that is associated with the location 
in the protected space; and 

automatically redirecting the intercepted request to read from the determined 
location in the redirected space instead of from the wher e in th e r e qu e st to acc es s a location in 
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the protected space is a r e quest to r e ad from th e protect e d spac e in a manner that is transparent to 
the requesting code . 

10. (Canceled). 

1 1 . (Currently Amended) The method of claim 3 wherein the request to 
aeeess -modifV a r the location in the protected space is a request to write to the protected space. 

12. (Canceled). 

13. (Original) The method of claim 11 wherein the redirecting the 
intercepted write request results in automatically allocating available space to use as new 
redirected space and writing data to a location in the new redirected space. 

14. (Original) The method of claim 3 wherein the determining the 
location in the redirected space that is associated with the location in the protected space further 
comprises first allocating available space to be used as the redirected space. 

15. (Currently Amended) The method of claim 3 wherein the storage device is 
one of a hard disk drive, a read/write CD ROM drive, a floppy disk drive, and o r a semi- 
persistent storage device. 

16. (Currently Amended) The method of claim 3 wherein the location in the 
protected space refers to at least one of a sector, a group of sectors, a cluster, and-or a group of 
clusters. 

17. (Currently Amended) The method of claim 3 wherein the location in the 
redirected space refers to at least one of a sector, a group of sectors, a cluster, a group of clusters, 
a virtual cluster, and-or a group of virtual clusters. 
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18. (Original) 



The method of claim 17 wherein the sector is a logical 



sector. 



19. (Original) 



The method of claim 17 wherein the sector is a physical 



sector. 



20. (Original) The method of claim 17 wherein the location in the 
protected space refers to a sector. 

21. (Original) The method of claim 17 wherein the location in the 
protected space refers to an abstraction of storage that is larger than a sector. 

22. (Original) The method of claim 3 wherein the redirected space is 
organized according to a combination of different storage units. 

23. (Original) The method of claim 22 wherein a portion of the redirected 
space is organized as one of virtual clusters, clusters, files, and sectors, and an other portion is 
organized according to a different storage unit. 



device; and 

performing the request without redirection to access the unprotected space. 



24. (Currently Amended) The method of claim 3, further comprising: 

designating a portion of the storage device as unprotected space; 

intercepting a request to access a location in the unprotected space of the storage 



25. (Currently Amended) The method of claim 3, further comprising: 
receiving a request to shutdown the computer system; and 
upon receiving the request to shutdown the computer system, 
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disregarding the data in the redirected space, so that when the computer 
system is rebooted, the data in the protected space of the storage device automatically appears 
unaltered. 

26. (Currently Amended) The method of claim 25 wherein disregarding the 
data in the redirected space comprises at least one of deleting the data from the storage in the 
redirected space, disassociating the redirected space from the protected space, and~or ignoring 
the data in the redirected space. 

27. (Original) The method of claim 3, further comprising: 
receiving a request to shutdown the computer system; and 

upon receiving the request to shutdown the computer system, 
saving the data stored in the redirected space. 

28. (Original) The method of claim 27 wherein saving the data stored in 
the redirected space comprises copying the data from the redirected space to associated locations 
in the protected space, thereby making permanent the data that was redirected to the redirected 
space. 

29. (Original) The method of claim 27 wherein saving the data stored in 
the redirected space comprises saving the association between the protected space and the 
redirected space without copying the data from the redirected space. 

30. (Original) The method of claim 3, further comprising using 
redirection tables to associate locations in the protected space to locations in the redirected space. 

31. (Currently Amended) The method of claim 30 wherein the redirection 
tables comprise at least one of a protected space redirection table, an available space table, and-or 
an unprotected space table. 
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32. (Currently Amended) A computer-readable memory medium containing 
in s tructions p rogram code t ha t, when loaded into a memory of a computer system during power- 
up initialization and executed, controls a computer processor to protect data stored in a portion 
of a storage device having a designated protected space, the computer system having a redirected 
space, by performing a method comprising : 

intercepting a request from requesting code to acc e ss modify a location in the 
protected space of the storage device; and 

determining a location in the redirected space that is associated with the location 
in the protected space; and 

redirecting the intercepted request to aeeess -modiiy the determined location in the 
redirected space instead of the location in the protected space, in a manner that is transparent to 
the requesting code, so that the data stored in the location in the protected space automatically 
remains unaltered when the computer system is restarted from a powered-down state . 

33. (Original) The computer-readable memory medium of claim 32 
wherein the designated protected space of the storage device comprises the entire storage device. 

34. (Original) The computer-readable memory medium of claim 32 
wherein the determined location in the redirected space resides in the storage device. 

35. (Original) The computer-readable memory medium of claim 32 
wherein the determined location in the redirected space resides in an other storage device. 

36. (Currently Amended) The computer-readable memory medium of claim 
32 . the method further comprising: 

intercepting from requesting code a request to read the location in the protected 
space of the storage device: 

determining the location in the redirected space that is associated with the location 
in the protected space; and 
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automatically redirecting the intercepted wh e r e in th e r e quest to acc e ss a location 
in th e protect e d space is a request to read from th e prot e cted spac e that r e sults in automatically 
r e ading data from the determined location in the redirected space instead of from the location in 
the protected space in a manner that is transparent to the requesting code . 

37. (Currently Amended) The computer-readable memory medium of claim 
32 wherein the request to aeeess -modifV a - the location in the protected space is a request to write 
to the protected space that results in automatically writing data to the determined location in the 
redirected space instead of to the location in the protected space. 

38. (Original) The computer-readable memory medium of claim 37 
wherein the redirecting the intercepted write request results in automatically allocating available 
space to use as new redirected space and writing data to a location in the new redirected space. 

39. (Original) The computer-readable memory medium of claim 32 
wherein the determining the location in the redirected space that is associated with the location in 
the protected space further comprises first allocating available space to be used as the redirected 
space. 

40. (Currently Amended) The computer-readable memory medium of claim 
32 wherein the storage device comprises one of a hard disk drive, a read/write CD ROM drive, a 
floppy disk drive, and-or a semi-persistent storage device. 

41. (Currently Amended) The computer-readable memory medium of claim 
32 wherein the location in the protected space refers to at least one of a sector, a group of sectors, 
a cluster, and-or a group of clusters. 
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42. (Currently Amended) The computer-readable memory medium of claim 
32 wherein the location in the redirected space refers to at least one of a sector, a group of 
sectors, a cluster, a group of clusters, a virtual cluster, m4-or a group of virtual clusters. 

43. (Original) The computer-readable memory medium of claim 42 
wherein the location in the protected space refers to a sector. 

44. (Original) The computer-readable memory medium of claim 42 
wherein the location in the protected space refers to an abstraction of storage that is larger than a 
sector. 



45. (Original) The computer-readable memory medium of claim 32 
wherein the redirected space is organized according to a combination of different storage units. 

46. (Original) The computer-readable memory medium of claim 45 
wherein a portion of the redirected space is organized as at least one of virtual clusters, clusters, 
files, and sectors, and an other portion is organized according to a different storage unit. 

47. (Currently Amended) The computer-readable memory medium of claim 
32, the method further comprising: 

designating a portion of the storage device as unprotected space; 

intercepting a request to access a location in the unprotected space of the storage 

device; and 

performing the request without redirection to access the unprotected space. 

48. (Currently Amended) The computer-readable memory medium of claim 
32, the method further comprising: 

receiving a request to shutdown the computer system; and 
upon receiving the request to shutdown the computer system, 
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disregarding the data in the redirected space, so that when the computer 
system is rebooted, the data in the protected space of the storage device automatically appears 
unaltered. 

49. (Currently Amended) The computer-readable memory medium of claim 
48 wherein disregarding the data in the redirected space comprises at least one of deleting the 
data from the storage in the redirected space, disassociating the redirected space from the 
protected space, aad-or ignoring the data in the redirected space. 

50. (Currently Amended) The computer-readable memory medium of claim 
32, the method further comprising: 

receiving a request to shutdown the computer system; and 
upon receiving the request to shutdown the computer system, 
saving the data stored in the redirected space. 

51. (Original) The computer-readable memory medium of claim 50 
wherein saving the data stored in the redirected space comprises copying the data from the 
redirected space to associated locations in the protected space, thereby making permanent the 
data that was redirected to the redirected space. 

52. (Original) The computer-readable memory medium of claim 50 
wherein saving the data stored in the redirected space comprises saving the association between 
the protected space and the redirected space without copying the data from the redirected space. 

53. (Original) The computer-readable memory medium of claim 32, 
further comprising using redirection tables to associate locations in the protected space to 
locations in the redirected space. 
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54. (Currently Amended) A computer system for automatically p rotecting 
data stored in a portion of a storage device, comprising: 

protected space designated on the storage device for storing the protected data; 

redirected storage space in the computer system designated for storing attempted 
modifications of the protected data; and 

redirection driver, install e d loaded in to a memory of the computer system when 
the system is booted from a powered-down state , that 

intercepts requests to aeeess -modify locations in the protected space; 
redirects intercepted requests so that the requests result in acc e ssing 
modifying locations in the redirected storage space instead of locations in the protected space, 
thereby leaving the protected space unaltere d so that, when the computer system is rebooted 
from a second powered-down state, the locations in the protected space automatically remain 
unaltered without restorative copying of data to the protected space . 

55. (Canceled). 

56. (Original) The computer system of claim 54, further comprising a 
redirection table that maps locations in the protected space to locations in the redirected storage 
space, and is used by the redirection driver to determine a location in the redirected storage space 
to use for redirecting an intercepted request. 

57. (Original) The computer system of claim 56 wherein the contents of 
the redirection table are saved by the computer system when the computer system is powered 
down. 

58. (Original) The computer system of claim 54 wherein the protected 
space comprises the entire storage device and the redirected storage space is not located on the 
storage device. 
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59. (Original) The computer system of claim 54 wherein the redirected 
storage space is located on the storage device. 

60. (Original) The computer system of claim 54 wherein an intercepted 
and redirected access request is a request to read from a location in the protected space. 

61. (Original) The computer system of claim 54 wherein an intercepted 
and redirected access request is a request to write to a location in the protected space that is 
redirected to modify a location in the redirected space. 

62. (Currently Amended) The computer system of claim 54 wherein the 
storage device is one of a hard disk drive, a read/write CD ROM drive, a floppy disk drive, and 
or a semi-persistent storage device. 

63. (Currently Amended) The computer system of claim 54 wherein the 
redirection driver refers to the redirected storage space in at least one of files, clusters, virtual 
clusters, aftd-or sectors of data. 

64. (Original) The computer system of claim 54 wherein the redirection 
driver refers to the redirected storage space using multiple data addressing abstractions. 

65. (Original) The computer system of claim 54 wherein the redirection 
driver implements a virtual cluster data abstraction. 

66. (Currently Amended) The computer system of claim 54 wherein the 
redirection driver is in s talled loaded by inserting the redirection driver into a chain of drivers so 
that it is automatically invoked by the computer system. 
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67. (Original) The computer system of claim 54, further comprising: 
unprotected space designated on the storage device for allowing modifications to 

a portion of the storage device. 

68. (Original) The computer system of claim 67 wherein the redirection 
driver disregards access requests to the unprotected space. 

69. (Original) The computer system of claim 67 wherein the redirection 
driver intercepts and redirects access requests to access locations in the unprotected space so that 
access to the unprotected data are also redirected. 

70. (Original) The computer system of claim 67, further comprising an 
unprotected space table for tracking the locations of the storage device that are designated as 
unprotected space. 

71. (Original) The computer system of claim 54 wherein the contents of 
the redirected storage space are saved by the computer system when the computer system is 
powered down. 

72. (Currently Amended) A method for s e curing protecting data in a storage 
device of a computer system having an operating system and a device driver, comprising: 

installing a redirection driver before the device driver in a calling sequence of the 
operating system, so that the operating system invokes the redirection driver in response to 
receiving a request to access the storage device; and 

under control of the redirection driver, 

intercepting a request to acc e ss modify a location on the storage device; 

and 

redirecting the request to aeeess -modify a location in unused storage, such 
that the data in the location on the storage device remains unaltered; and 
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restarting the computer system from a powered-down state, wherein the data 
stored in the location on the storage device automatically remains unaltered, without requiring 
any restorative copying of dat a to the location on the storage device . 

73. (Original) The method of claim 72 wherein the redirection driver 
cannot be uninstalled by a user without special access privileges, thereby forcing the data to be 
securely maintained. 

74. (Original) The method of claim 72, the device driver comprising one 
of a plurality of device drivers that are arranged in a layered fashion, and wherein the redirection 
driver is installed between two of these device drivers. 

75. (Original) The method of claim 74 wherein each driver layer 
comprises a driver that communicates with an associated device according to different data 
abstraction; and wherein the redirection driver can be configured to be installed at different 
layers depending upon the data abstraction implemented by the redirection driver. 

76. (Currently Amended) The method of claim 72 wherein the redirection 
driver handles blocks of data defined as at least one of virtual clusters, clusters, sectors, and-or 
files. 

77. (Original) The method of claim 72 wherein the redirection driver 
handles multiple different data abstractions. 

78. (Currently Amended) The method of claim 72 wherein the computer 
system comprises redirection tables that are maintained by the redirection driver to manage 
associations between data that has been redirected by redirecting the acc ess request to the 
location in unused storage and unaltered data stored on the storage device. 
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79. (Currently Amended) A storage access redirection system for s e curing 
protecting data in designated locations on a storage device in a computer system comprising: 

available space table; 

protected space redirection table; and 

redirection driver, installed in the computer system upon power-up initialization , 

that 

automatically intercepts a request to access write to one of the designated 

locations; 

uses the protected space redirection table to determine whether the 
designated location has been previously redirected; 

when it is determined that the designated location has been previously 
redirected, determines an associated redirected location; and 

redirects the access write r equest to the associated redirected location so 
that data in the designated location automatically remains unaltered even when the computer 
system is rebooted . 

80. (Currently Amended) The storage access redirection system of claim 79, 
further comprising: 

unprotected space table that is used to designate unprotected locations on the 
storage device that can be altered, wherein the redirection driver intercepts requests to access 
locations referred to by the unprotected space table and disregards them so that data in the 
unprotected locations on the storage device is- are modified according to the access requests. 

81. (Currently Amended) The storage access redirection system of claim 79 
wherein the redirection driver receives a wh e r e in th e request to aeeess- read one of the designated 
locations is a read reque s t and redirects the read request to an associated redirected location 
when it is determined that the designated location has been previously redirected . 

82. (Canceled). 
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83. (Currently Amended) The storage access redirection system of claim $2 
79 wherein the redirection driver, when it is determined that the designated location has not been 
previously redirected, uses the available space table to allocate a new redirected location, uses 
the protected space redirection table to map the new redirected location to the designated 
location, and determines the new redirected location as the associated redirected location. 
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